Website security header check
See which protections your site sends to a browser, which it leaves out, and what each omission exposes. One URL, one run, no account.
We read what your server sends a browser. Nothing is probed, injected or attacked.
What this check actually looks at
A letter grade tells you nothing about which attack it protects against. This check reports each header your site sends, each one it omits, and the consequence of the omission in a sentence — so the fix is a config line rather than a research project.
- Transport security
HSTS and its max-age. Under six months is worth raising.
- Content Security Policy
Whether one exists, and whether it still allows unsafe-inline.
- Framing and content type
X-Frame-Options and nosniff — clickjacking and MIME confusion.
- Cookie flags
Secure, HttpOnly and SameSite on anything that identifies a session.
- Mixed content
Resources still loaded over HTTP on an HTTPS page.
What a result looks like
CSP, Permissions-Policy and Referrer-Policy missing.
Nothing loads over plain HTTP.
One of them carries the session.
Each finding names the header, the exact directive to add and what breaks if you add it carelessly. We do not publish a grade — an A on a site with an unprotected session cookie is a worse outcome than an honest list.
A check tells you about today. Monitoring tells you at 04:00.
Headers disappear without anyone deciding to remove them: a proxy rule rewritten, a CDN setting reset, a framework upgrade that changed a default. Monitoring re-runs this exact check and tells you which release stopped sending what, while it is still one line to put back.
Common questions
- Is this the same engine as the paid monitoring?
- Yes — the same checks, run the same way. The difference is that monitoring repeats them on a schedule and keeps the history, which is what turns a number into a trend and a trend into an alert.
- Does testing my site slow it down or change anything?
- No. Everything is read from the outside, the way a visitor arrives — no agent, no script on your pages, nothing written. Our requests identify themselves so you can recognise them in your own logs.
- Is this a penetration test?
- No, and it is important that it is not. We read the responses your site gives a normal visitor. Nothing is fuzzed, brute-forced or exploited, so you can run it against production without warning anyone.
- Why does my score differ from other header checkers?
- Most of them grade the presence of a header. We look at what it is set to — a CSP that allows unsafe-inline everywhere counts as present, and it is not protecting you.
Related tests
A free test is a snapshot. Monitoring is the product.